如何在我的网站上进行安全登录？

Question

Good day. I'm writing a social network and I need to make a very protected auth form. I decided to post data through ajax and save a login into cookies. BUT login can be wrote in hacker's cookies easily. Then I remembered about user hash, which can be generated from PHP every time when user logins and write in DB and then compare. BUT login must be allowed in different devices at the same time. How to make a secure auth?

Answer 1

If you want a secure login, you have to think about https.

I would use the PHP super global $_SESSION to store your session status, user email etc.

Example using PDO in PHP:

function login($email, $password)
{
    $stmt = $pdo->prepare("SELECT password FROM users WHERE email = ? LIMIT 1");
    $stmt->execute(array($email));
    $pw = $stmt->fetchColumn();
    if(password_verify($password, $pw)) {  //password is correct
        $_SESSION['logged_in'] = true;
        $_SESSION['email'] = $email;
        return true;
    } else return false;
}

You should definetely use prepared statements since you take user input that might be dangerous. And don't forget about the password_hash and password_verify functions, so the passwords are encrypted safely. Store the encrypted passwords in your database and check if the encrypted user input mathes the encrypted password. DON'T USE md5, it's not safe.

Follow this link to learn more about $_SESSION 's

Conclusion

• use $_SESSIONs
• password_hash and password_verify instead of md5
• use prepared statements when querying your database

Hope this helps a little bit.